---
schema_version: '1.0'
id: security-20260711-10a0ef
url: https://osv.dev/vulnerability/PYSEC-2026-142
url_hash: 10a0ef3c316612cf35abaf8a6aa6bf42c2aac5b58fc0da98cc1e8878867b8b7b
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-142
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-44432
- PYSEC-2026-142
- severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- urllib3
- PyPI
lang: en
published_at: '2026-05-13T16:16:57Z'
fetched_at: '2026-07-11T06:37:18Z'
updated_at: '2026-07-11T06:40:39Z'
status: published
content_hash: 39007e90c04f544ed380763e89e5a6b8951a977e98d7f89c5135d0be5ac9de82
license_note: full
summary: urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0,
  urllib3 could decompress the whole response instead of the requested portion (1)
  during the second HTTPResponse.read(amt=N) call when the response was decompressed
  using the official Brotli library or (2) w
summary_source: rss
summary_en: urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0,
  urllib3 could decompress the whole response instead of the requested portion (1)
  during the second HTTPResponse.read(amt=N) call when the response was decompressed
  using the official Brotli library or (2) w
entities: []
key_facts: []
related: []
related_auto: []
title: CVE-2026-44432 — urllib3
---

# CVE-2026-44432 — urllib3

## TL;DR
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) w

## Key Points
- cve / CVE-2026-44432 / PYSEC-2026-142 / severity:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H / urllib3 / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
**Advisory:** PYSEC-2026-142 (CVE-2026-44432)

**Affected (your watchlist):**
- `PyPI:urllib3` 2.6.3 → fixed in 2.7.0 [docker/docker-llmwiki]

**Details:**
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.

**References:**
- https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-142_

## Source
元記事: [CVE-2026-44432 — urllib3](https://osv.dev/vulnerability/PYSEC-2026-142) — published 2026-05-13T16:16:57Z